Blog · AI for small and midsize businesses

AI assistant permissions: keep company information within the right roles

An assistant must enforce information permissions before sending evidence to the model. Restricting the final wording is insufficient. A role-and-source matrix, synthetic test accounts and checks after access changes help expose gaps before staff rely on the assistant for internal questions.

By Guillermo Ayala López · 3 min read

Separate employee paths to shared and restricted document rooms. — AI-generated editorial illustration.

In this article

Authorize the evidence first
Create a role-and-source matrix
Test both allowed and denied paths
Limit connected capabilities too

An employee asks an ordinary question and receives a sensitive salary detail because both general procedures and personnel files were indexed together. The problem is not only the wording of the answer. Restricted information reached a component that should never have received it for that user.

Authorize the evidence first

Authentication establishes who the user is; authorization establishes what that person may access. Microsoft's secure RAG architecture requires grounding information to be authorized for the user. Enforce this through application and data controls before the model receives retrieved passages. A request saying “I am the HR director” must not change access. The application uses the authenticated identity and approved roles. Source permissions need to carry through to indexed passages, search results, citations and any cached answers.

Create a role-and-source matrix

Synthetic access example, not real employee records
Source	General staff	Sales role	HR role
Office procedures	Allowed	Allowed	Allowed
Approved sales playbook	Denied	Allowed	Denied unless separately authorized
Synthetic personnel case	Denied	Denied	Allowed within assigned responsibilities

The information owner approves the matrix. The identity administrator maps actual accounts to roles. The technical partner verifies retrieval behavior. Do not assume a senior title grants all access or that an HR role automatically permits every personnel record.

Test both allowed and denied paths

Create synthetic accounts and recognizable synthetic facts. Ask a permitted user a question whose evidence they may read; verify the answer and source link. Ask an unauthorized user the same question, a paraphrase and a request to summarize all documents. Check the underlying retrieval and application records, not only the visible refusal. Test a role change, revoked access and a conversation continued after permissions change. Check whether previous search results or cached answers become available to another identity. The exact controls depend on the platform, so a technical reviewer must inspect the implemented path.

Limit connected capabilities too

If the assistant uses tools, grant only the reads or actions required for its purpose. OWASP's excessive-agency guidance recommends minimizing functionality and permissions and enforcing authorization outside model discretion. A read-only document assistant does not need tools that delete files or change employee records. Record denied-access test results separately from answer quality. A fluent answer is not evidence that access boundaries hold. Define a route to pause affected sources and investigate if restricted evidence appears where it should not. Treat permission changes as operational changes that require verification. The administrator should know how long revocation takes to affect search and cached results. Test the agreed behavior, document the limit and restrict the affected path if it cannot be met. A visible refusal after unauthorized passages reached the model does not demonstrate that the retrieval boundary held. Bring your roles, source categories and a synthetic access matrix to a RAG permissions review before combining restricted and shared knowledge in one assistant.

Back to the blog · Practical AI guides